Microsoft Security Copilot
Microsoft Security Copilot is a generative AI assistant for security teams that helps investigate alerts, summarize incidents and guide response using data from Microsoft security products, with capacity based billing in Security Compute Units so organizations can control usage and spend.
Overview
Microsoft Security Copilot is designed for security operations teams that need to move faster from alert to understanding to action. It applies generative AI to security workflows by letting analysts ask natural language questions about incidents, threats and remediation, and it can summarize investigation context into reports that are easier to share with stakeholders. Microsoft positions it as a companion to existing Microsoft security products, where features such as incident summarization in Microsoft Defender and guidance for investigations in tools like Microsoft Sentinel can be combined with Copilot prompts and promptbooks.
The service is capacity based and uses Security Compute Units, or SCUs, to measure the compute required to run prompts and related features. On the official pricing page, provisioned capacity has a minimum of 1 SCU, is priced per hour and billed monthly, and an example shows charging at $4 per provisioned SCU for an hourly block. Organizations can also set overage limits to handle spikes, and Microsoft provides a web based calculator to estimate SCU needs.
Security Copilot can be extended through plugins and Microsoft has documentation describing custom plugins that can connect to data sources and APIs, including Microsoft Graph based integrations across parts of the Microsoft security ecosystem. Security Copilot is most useful when you already rely on Microsoft security telemetry and want faster triage, consistent narratives and guided remediation steps. It is not a replacement for a SIEM or XDR, but an AI layer that helps analysts query and act on those systems with less manual context switching.
Key features
- Incident summarization: Generate concise summaries of security incidents and alerts to speed handoffs and reduce triage time.
- Promptbooks: Use reusable guided prompt sequences for common tasks like investigation and remediation planning and security reporting.
- Capacity based billing: Size usage with Security Compute Units and manage spend with provisioned capacity and overage limits.
- Defender integration: Combine Copilot prompts with Microsoft Defender incident context to accelerate investigation workflows.
- Sentinel workflows: Support SIEM style investigation by querying and summarizing incident data when using Microsoft Sentinel.
- Role based use cases: Microsoft publishes role and scenario guidance so teams can map prompts to SOC and IT responsibilities.
- Extensibility plugins: Build or use plugins to connect additional data sources and automate actions through supported APIs.
- Usage management tools: Use the official calculator and usage guidance to estimate SCU needs and monitor consumption over time.
Best for
- Alert triage: Ask Copilot to summarize what happened across related alerts so analysts can prioritize incidents faster during busy shifts.
- Incident investigation: Use promptbooks to gather context and identify affected assets and propose next steps for containment.
- Executive reporting: Turn incident timelines into readable summaries for leadership and compliance without manual rewriting.
- Threat hunting support: Query security telemetry in natural language to explore indicators and pivot across related activity.
- Remediation planning: Generate action checklists and validation steps so responders can coordinate fixes across teams and track closure.
- Shift handover notes: Create consistent handover briefs so the next analyst can continue investigation without losing context.
- Capacity sizing: Estimate SCU needs with the calculator and set provisioned and overage limits to manage cost predictably.
- Plugin automation: Connect approved tools via plugins to enrich investigations or trigger safe follow up actions from Copilot.
Capabilities
Incident Summaries
Generate structured incident summaries that combine key signals and timelines, helping analysts understand scope faster and produce clearer handoffs and reports without manual copy and paste.
Promptbooks Workflow
Run reusable promptbooks for common SOC tasks such as triage, investigation and remediation planning. This supports consistent execution across analysts and reduces variation between shifts.
SCU Capacity Model
Operate Security Copilot as a capacity based service using Security Compute Units. Provision SCUs per hour and set overage limits so you can balance performance with budget and expected workload.
Plugins and Connectors
Extend Security Copilot with plugins that connect approved data sources and APIs, enabling enrichment and guided actions while keeping control of what external systems are queried or changed.
Frequently Asked Questions
How is Microsoft Security Copilot priced?
Microsoft prices Security Copilot through Security Compute Units. Provisioned capacity has a minimum of 1 SCU, is priced per hour and billed monthly, and the pricing page shows $4 per provisioned SCU for an hourly block, with optional overage for spikes.
What data does it use and how should we handle privacy?
Security Copilot works from the security data your organization already collects. Apply least privilege and retention policies, and avoid entering sensitive personal data into prompts unless your compliance team approves the workflow and logging approach.
Which integrations and APIs are supported?
Security Copilot is designed to work with Microsoft security products and can be extended with plugins. Microsoft documentation describes custom plugins that connect to data sources and APIs, including Microsoft Graph, so you can enrich investigations and automate steps.
What does deployment and setup require?
Adoption typically starts with defining scenarios and promptbooks for your SOC. You will also need to plan SCU capacity and cost controls, and ensure analysts are trained on safe prompting and how to validate outputs before taking action.
How does it compare to other security copilots?
Security Copilot is positioned for teams already invested in Microsoft security tooling and who want a unified AI layer across Defender and Sentinel style workflows. Evaluate legal risk and accountability by keeping a human in the loop for decisions and actions.
